The vulnerability allows an attacker who can supply a raw WeChat openid cookie to impersonate a registered fan. By doing so the attacker can call public fan-exposed endpoints to read personal identifiers such as nickname, phone, and unionid, as well as read and modify fan tags. This constitutes a privacy breach and could erode user trust in the application.

Any deployment of Niefy wx-api version 0.8.2 that exposes the /wxUser/getUserInfo and /wxUserTags endpoints and accepts an unverified openid cookie is affected. The issue resides in the Shiro configuration handling that fails to validate the cookie’s authenticity.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote; an attacker who knows a victim’s openid can craft and send HTTP requests with the cookie to impersonate that user. Exploitation requires no special privileges beyond network access to the API and knowledge of an existing openid value.